Commit faf096ff authored by Dave Airlie's avatar Dave Airlie
Browse files

Merge tag 'vmwgfx-next-2014-01-13' of git://people.freedesktop.org/~thomash/linux into drm-next 

Anyway, nothing big here, Three more code cleanup patches from Rashika
Kheria, and one TTM/vmwgfx patch from me that tightens security around TTM
objects enough for them to opened using prime objects from render nodes:

Previously any client could access a shared buffer using the "name", also
without actually opening it. Now a reference is required, and for render nodes
such a reference is intended to only be obtainable using a prime fd.

vmwgfx-next 2014-01-13 pull request

* tag 'vmwgfx-next-2014-01-13' of git://people.freedesktop.org/~thomash/linux:
  drivers: gpu: Mark functions as static in vmwgfx_fence.c
  drivers: gpu: Mark functions as static in vmwgfx_buffer.c
  drivers: gpu: Mark functions as static in vmwgfx_kms.c
  drm/ttm: ttm object security fixes for render nodes
parents a095c60b 94844cf0

drivers/gpu/drm/ttm/ttm_object.c

+54 −36
Original line number Diff line number Diff line
@@ -68,7 +68,7 @@ 


struct ttm_object_file {

	struct ttm_object_device *tdev;

	rwlock_t lock;

	spinlock_t lock;

	struct list_head ref_list;

	struct drm_open_hash ref_hash[TTM_REF_NUM];

	struct kref refcount;
@@ -118,6 +118,7 @@ struct ttm_object_device { 
 */



struct ttm_ref_object {

	struct rcu_head rcu_head;

	struct drm_hash_item hash;

	struct list_head head;

	struct kref kref;
@@ -210,11 +211,10 @@ static void ttm_release_base(struct kref *kref) 
	 * call_rcu() or ttm_base_object_kfree().

	 */



	if (base->refcount_release) {

	ttm_object_file_unref(&base->tfile);

	if (base->refcount_release)

		base->refcount_release(&base);

}

}



void ttm_base_object_unref(struct ttm_base_object **p_base)

{
@@ -229,32 +229,46 @@ EXPORT_SYMBOL(ttm_base_object_unref); 
struct ttm_base_object *ttm_base_object_lookup(struct ttm_object_file *tfile,

					       uint32_t key)

{

	struct ttm_object_device *tdev = tfile->tdev;

	struct ttm_base_object *uninitialized_var(base);

	struct ttm_base_object *base = NULL;

	struct drm_hash_item *hash;

	struct drm_open_hash *ht = &tfile->ref_hash[TTM_REF_USAGE];

	int ret;



	rcu_read_lock();

	ret = drm_ht_find_item_rcu(&tdev->object_hash, key, &hash);

	ret = drm_ht_find_item_rcu(ht, key, &hash);



	if (likely(ret == 0)) {

		base = drm_hash_entry(hash, struct ttm_base_object, hash);

		ret = kref_get_unless_zero(&base->refcount) ? 0 : -EINVAL;

		base = drm_hash_entry(hash, struct ttm_ref_object, hash)->obj;

		if (!kref_get_unless_zero(&base->refcount))

			base = NULL;

	}

	rcu_read_unlock();



	if (unlikely(ret != 0))

		return NULL;

	return base;

}

EXPORT_SYMBOL(ttm_base_object_lookup);



	if (tfile != base->tfile && !base->shareable) {

		pr_err("Attempted access of non-shareable object\n");

		ttm_base_object_unref(&base);

		return NULL;

struct ttm_base_object *

ttm_base_object_lookup_for_ref(struct ttm_object_device *tdev, uint32_t key)

{

	struct ttm_base_object *base = NULL;

	struct drm_hash_item *hash;

	struct drm_open_hash *ht = &tdev->object_hash;

	int ret;



	rcu_read_lock();

	ret = drm_ht_find_item_rcu(ht, key, &hash);



	if (likely(ret == 0)) {

		base = drm_hash_entry(hash, struct ttm_base_object, hash);

		if (!kref_get_unless_zero(&base->refcount))

			base = NULL;

	}

	rcu_read_unlock();



	return base;

}

EXPORT_SYMBOL(ttm_base_object_lookup);

EXPORT_SYMBOL(ttm_base_object_lookup_for_ref);



int ttm_ref_object_add(struct ttm_object_file *tfile,

		       struct ttm_base_object *base,
@@ -266,21 +280,25 @@ int ttm_ref_object_add(struct ttm_object_file *tfile, 
	struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;

	int ret = -EINVAL;



	if (base->tfile != tfile && !base->shareable)

		return -EPERM;



	if (existed != NULL)

		*existed = true;



	while (ret == -EINVAL) {

		read_lock(&tfile->lock);

		ret = drm_ht_find_item(ht, base->hash.key, &hash);

		rcu_read_lock();

		ret = drm_ht_find_item_rcu(ht, base->hash.key, &hash);



		if (ret == 0) {

			ref = drm_hash_entry(hash, struct ttm_ref_object, hash);

			kref_get(&ref->kref);

			read_unlock(&tfile->lock);

			if (!kref_get_unless_zero(&ref->kref)) {

				rcu_read_unlock();

				break;

			}

		}



		read_unlock(&tfile->lock);

		rcu_read_unlock();

		ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref),

					   false, false);

		if (unlikely(ret != 0))
@@ -297,19 +315,19 @@ int ttm_ref_object_add(struct ttm_object_file *tfile, 
		ref->ref_type = ref_type;

		kref_init(&ref->kref);



		write_lock(&tfile->lock);

		ret = drm_ht_insert_item(ht, &ref->hash);

		spin_lock(&tfile->lock);

		ret = drm_ht_insert_item_rcu(ht, &ref->hash);



		if (likely(ret == 0)) {

			list_add_tail(&ref->head, &tfile->ref_list);

			kref_get(&base->refcount);

			write_unlock(&tfile->lock);

			spin_unlock(&tfile->lock);

			if (existed != NULL)

				*existed = false;

			break;

		}



		write_unlock(&tfile->lock);

		spin_unlock(&tfile->lock);

		BUG_ON(ret != -EINVAL);



		ttm_mem_global_free(mem_glob, sizeof(*ref));
@@ -330,17 +348,17 @@ static void ttm_ref_object_release(struct kref *kref) 
	struct ttm_mem_global *mem_glob = tfile->tdev->mem_glob;



	ht = &tfile->ref_hash[ref->ref_type];

	(void)drm_ht_remove_item(ht, &ref->hash);

	(void)drm_ht_remove_item_rcu(ht, &ref->hash);

	list_del(&ref->head);

	write_unlock(&tfile->lock);

	spin_unlock(&tfile->lock);



	if (ref->ref_type != TTM_REF_USAGE && base->ref_obj_release)

		base->ref_obj_release(base, ref->ref_type);



	ttm_base_object_unref(&ref->obj);

	ttm_mem_global_free(mem_glob, sizeof(*ref));

	kfree(ref);

	write_lock(&tfile->lock);

	kfree_rcu(ref, rcu_head);

	spin_lock(&tfile->lock);

}



int ttm_ref_object_base_unref(struct ttm_object_file *tfile,
@@ -351,15 +369,15 @@ int ttm_ref_object_base_unref(struct ttm_object_file *tfile, 
	struct drm_hash_item *hash;

	int ret;



	write_lock(&tfile->lock);

	spin_lock(&tfile->lock);

	ret = drm_ht_find_item(ht, key, &hash);

	if (unlikely(ret != 0)) {

		write_unlock(&tfile->lock);

		spin_unlock(&tfile->lock);

		return -EINVAL;

	}

	ref = drm_hash_entry(hash, struct ttm_ref_object, hash);

	kref_put(&ref->kref, ttm_ref_object_release);

	write_unlock(&tfile->lock);

	spin_unlock(&tfile->lock);

	return 0;

}

EXPORT_SYMBOL(ttm_ref_object_base_unref);
@@ -372,7 +390,7 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile) 
	struct ttm_object_file *tfile = *p_tfile;



	*p_tfile = NULL;

	write_lock(&tfile->lock);

	spin_lock(&tfile->lock);



	/*

	 * Since we release the lock within the loop, we have to
@@ -388,7 +406,7 @@ void ttm_object_file_release(struct ttm_object_file **p_tfile) 
	for (i = 0; i < TTM_REF_NUM; ++i)

		drm_ht_remove(&tfile->ref_hash[i]);



	write_unlock(&tfile->lock);

	spin_unlock(&tfile->lock);

	ttm_object_file_unref(&tfile);

}

EXPORT_SYMBOL(ttm_object_file_release);
@@ -404,7 +422,7 @@ struct ttm_object_file *ttm_object_file_init(struct ttm_object_device *tdev, 
	if (unlikely(tfile == NULL))

		return NULL;



	rwlock_init(&tfile->lock);

	spin_lock_init(&tfile->lock);

	tfile->tdev = tdev;

	kref_init(&tfile->refcount);

	INIT_LIST_HEAD(&tfile->ref_list);

drivers/gpu/drm/vmwgfx/vmwgfx_buffer.c

+4 −4
Original line number Diff line number Diff line
@@ -517,7 +517,7 @@ static struct ttm_backend_func vmw_ttm_func = { 
	.destroy = vmw_ttm_destroy,

};



struct ttm_tt *vmw_ttm_tt_create(struct ttm_bo_device *bdev,

static struct ttm_tt *vmw_ttm_tt_create(struct ttm_bo_device *bdev,

				 unsigned long size, uint32_t page_flags,

				 struct page *dummy_read_page)

{
@@ -546,12 +546,12 @@ out_no_init: 
	return NULL;

}



int vmw_invalidate_caches(struct ttm_bo_device *bdev, uint32_t flags)

static int vmw_invalidate_caches(struct ttm_bo_device *bdev, uint32_t flags)

{

	return 0;

}



int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,

static int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type,

		      struct ttm_mem_type_manager *man)

{

	switch (type) {
@@ -589,7 +589,7 @@ int vmw_init_mem_type(struct ttm_bo_device *bdev, uint32_t type, 
	return 0;

}



void vmw_evict_flags(struct ttm_buffer_object *bo,

static void vmw_evict_flags(struct ttm_buffer_object *bo,

		     struct ttm_placement *placement)

{

	*placement = vmw_sys_placement;

drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

+5 −4
Original line number Diff line number Diff line
@@ -271,7 +271,7 @@ void vmw_fence_obj_unreference(struct vmw_fence_obj **fence_p) 
	spin_unlock_irq(&fman->lock);

}



void vmw_fences_perform_actions(struct vmw_fence_manager *fman,

static void vmw_fences_perform_actions(struct vmw_fence_manager *fman,

				struct list_head *list)

{

	struct vmw_fence_action *action, *next_action;
@@ -897,7 +897,7 @@ static void vmw_event_fence_action_cleanup(struct vmw_fence_action *action) 
 * Note that the action callbacks may be executed before this function

 * returns.

 */

void vmw_fence_obj_add_action(struct vmw_fence_obj *fence,

static void vmw_fence_obj_add_action(struct vmw_fence_obj *fence,

			      struct vmw_fence_action *action)

{

	struct vmw_fence_manager *fman = fence->fman;
@@ -993,7 +993,7 @@ struct vmw_event_fence_pending { 
	struct drm_vmw_event_fence event;

};



int vmw_event_fence_action_create(struct drm_file *file_priv,

static int vmw_event_fence_action_create(struct drm_file *file_priv,

				  struct vmw_fence_obj *fence,

				  uint32_t flags,

				  uint64_t user_data,
@@ -1080,7 +1080,8 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, 
	 */

	if (arg->handle) {

		struct ttm_base_object *base =

			ttm_base_object_lookup(vmw_fp->tfile, arg->handle);

			ttm_base_object_lookup_for_ref(dev_priv->tdev,

						       arg->handle);



		if (unlikely(base == NULL)) {

			DRM_ERROR("Fence event invalid fence object handle "

drivers/gpu/drm/vmwgfx/vmwgfx_kms.c

+6 −6
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ struct vmw_clip_rect { 
 * Clip @num_rects number of @rects against @clip storing the

 * results in @out_rects and the number of passed rects in @out_num.

 */

void vmw_clip_cliprects(struct drm_clip_rect *rects,

static void vmw_clip_cliprects(struct drm_clip_rect *rects,

			int num_rects,

			struct vmw_clip_rect clip,

			SVGASignedRect *out_rects,
@@ -423,7 +423,7 @@ struct vmw_framebuffer_surface { 
	struct drm_master *master;

};



void vmw_framebuffer_surface_destroy(struct drm_framebuffer *framebuffer)

static void vmw_framebuffer_surface_destroy(struct drm_framebuffer *framebuffer)

{

	struct vmw_framebuffer_surface *vfbs =

		vmw_framebuffer_to_vfbs(framebuffer);
@@ -589,7 +589,7 @@ out_free_tmp: 
	return ret;

}



int vmw_framebuffer_surface_dirty(struct drm_framebuffer *framebuffer,

static int vmw_framebuffer_surface_dirty(struct drm_framebuffer *framebuffer,

				  struct drm_file *file_priv,

				  unsigned flags, unsigned color,

				  struct drm_clip_rect *clips,
@@ -761,7 +761,7 @@ struct vmw_framebuffer_dmabuf { 
	struct vmw_dma_buffer *buffer;

};



void vmw_framebuffer_dmabuf_destroy(struct drm_framebuffer *framebuffer)

static void vmw_framebuffer_dmabuf_destroy(struct drm_framebuffer *framebuffer)

{

	struct vmw_framebuffer_dmabuf *vfbd =

		vmw_framebuffer_to_vfbd(framebuffer);
@@ -947,7 +947,7 @@ static int do_dmabuf_dirty_sou(struct drm_file *file_priv, 
	return ret;

}



int vmw_framebuffer_dmabuf_dirty(struct drm_framebuffer *framebuffer,

static int vmw_framebuffer_dmabuf_dirty(struct drm_framebuffer *framebuffer,

				 struct drm_file *file_priv,

				 unsigned flags, unsigned color,

				 struct drm_clip_rect *clips,
@@ -1677,7 +1677,7 @@ void vmw_disable_vblank(struct drm_device *dev, int crtc) 
 * Small shared kms functions.

 */



int vmw_du_update_layout(struct vmw_private *dev_priv, unsigned num,

static int vmw_du_update_layout(struct vmw_private *dev_priv, unsigned num,

			 struct drm_vmw_rect *rects)

{

	struct drm_device *dev = dev_priv->dev;

drivers/gpu/drm/vmwgfx/vmwgfx_surface.c

+2 −1
Original line number Diff line number Diff line
@@ -843,6 +843,7 @@ out_unlock: 
int vmw_surface_reference_ioctl(struct drm_device *dev, void *data,

				struct drm_file *file_priv)

{

	struct vmw_private *dev_priv = vmw_priv(dev);

	union drm_vmw_surface_reference_arg *arg =

	    (union drm_vmw_surface_reference_arg *)data;

	struct drm_vmw_surface_arg *req = &arg->req;
@@ -854,7 +855,7 @@ int vmw_surface_reference_ioctl(struct drm_device *dev, void *data, 
	struct ttm_base_object *base;

	int ret = -EINVAL;



	base = ttm_base_object_lookup(tfile, req->sid);

	base = ttm_base_object_lookup_for_ref(dev_priv->tdev, req->sid);

	if (unlikely(base == NULL)) {

		DRM_ERROR("Could not find surface to reference.\n");

		return -EINVAL;

CRA Git | Maintained and supported by SUSTech CRA and CCSE